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ABSTRACT 



WLAN Device-free passive (DfP) indoor localization is an 
emerging technology enabling the localization of entities that 
do not carry any devices nor participate actively in the local- 
ization process using the already installed wireless infras- 
tructure. This technology is useful for a variety of applica- 
tions such as intrusion detection, smart homes and border 
protection. 

We present the design, implementation and evaluation of 
RASID, a DfP system for human motion detection. RASID 
combines different modules for statistical anomaly detection 
while adapting to changes in the environment to provide ac- 
curate, robust, and low-overhead detection of human activ- 
ities using standard WiFi hardware. Evaluation of the sys- 
tem in two different testbeds shows that it can achieve an 
accurate detection capability in both environments with an 
F-measure of at least 0.93. In addition, the high accuracy 
and low overhead performance are robust to changes in the 
environment as compared to the current state of the art DfP 
detection systems. We also relay the lessons learned during 
building our system and discuss future research directions. 

Keywords 

Anomaly detection, device- free passive localization, mo- 
tion detection systems, robust device-free localization. 

1. INTRODUCTION 

The increasing need for context-aware information 
and the rapid advancements in communication networks 
have motivated significant research effort in the area 
of location-based services. This effort resulted in the 
development of many location determination systems, 
including the GPS system [1], ultrasonic-based systems 
[2] , infrared-based (IR) systems [3] , and radio frequency- 
based (RF) systems [4]. Moreover, motion detection 
systems, that aim at detecting the motion of an entity 
carrying a device, were also developed [SHI31- These 
systems require the tracked entity to carry a device that 
participates in the localization process. Thus, we refer 
to them as device-based systems. 

Motivated by the wide use of wireless LANs for indoor 




Figure 1: RASID system architecture. 



communication, we recently introduced the concept of 
device-free passive DfP localization [M] which enables 
the detection and tracking of entities that do not carry 
any devices nor participate in the localization process. 
This concept depends on the fact that the presence and 
motion of entities in an RF environment affects the RF 
signal strength, especially when dealing with the 2.4 
GHz band which is used in different IEEE standards 
such as 802.11b and 802. llg (WiFi). Different DfP al- 
gorithms were proposed for detection p^lTS] and track- 
ing [HIITMTS] of entities in indoor environments. Our 
focus in this paper is on the detection problem. 

In particular, we address the problem of designing 
a low-overhead, accurate, and robust DfP motion de- 
tection system. We introduce the RASID system that 
provides a software only solution on top of the already 
installed wireless networks enabling a wide set of appli- 
cations including intrusion detection, border protection, 
and smart homes. As a typical DfP system, RASID 
consists of signal transmitters, such as access points 
(APs) , signal receivers or monitoring points (MPs) , such 
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as standard laptop^ and an application server which 
collects and processes information about the received 
signals from each MP. The application server contains 
the main system modules responsible for performing the 
detection function (Figured]). 

Our research on RASID is motivated by several fac- 
tors: First, the technologies that can be used to provide 
the desired detection capability (e.g. cameras [19], IR 
sensors, radio tomographic imaging [20| . pressure sen- 
sors [21] , etc) share the requirement of installing special 
hardware. In addition, cameras and IR sensors are lim- 
ited to line-of-sight vision and thus the cost of covering 
an area might be prohibitive. Moreover, regular cam- 
eras fail to work in the dark or in the presence of smoke. 
RASID avoids these drawbacks by using the already 
installed wireless infrastructure without installing any 
special hardware. It also makes use of the fact that RF 
waves do not require LOS for propagation. 

From another perspective, the previously proposed 
WLAN DfP detection techniques [14j[T5] provide good 
performance under strong assumptions, which limit their 
application domain. For example, they are not robust 
to changes in the environment. That is they do not 
adapt to changes in the environment, e.g. humidity and 
temperature changes. Moreover, their parameters need 
to be changed as the deployment area changes. In ad- 
dition, the technique proposed in [15] requires the con- 
struction of a human motion profile which leads to high 
overhead inside large-scale environments. The cost of 
this technique may be prohibitive, as it requires access 
to all areas of a building which might include restricted 
or private areas and requires several hours of calibra- 
tion. Finally, all techniques were either evaluated in 
controlled environments, e.g. [Tl], or in small-scale real 
environments, e.g. |15j . 

In order to achieve its objectives, RASID uses a sta- 
tistical anomaly detection technique to detect motion 
inside indoor environments. i?^S'/D only constructs a 
non-parametric profile for the signal strength readings 
received at the MPs when there is no human activity 
during a short training phase of only two minutes, lead- 
ing to minimal deployment overhead. RASID also em- 
ploys techniques for continuously updating its silence 
profile to adapt to the environment changes. The sys- 
tem also applies a decision refinement procedure in or- 
der to reduce the false alarms due to the signal noise. 
Furthermore, RASID also provides an interface by which 
the regions of activity can be identified. We evaluate 
the system in two different large-scale environments rich 
in multi-path and compare RASID to the state-of-the- 
art DfP detection techniques [14l|T5]. Our results show 
that RASID achieves its goals of high accuracy in both 
environments with minimal deployment overhead. In 

^Note that it is also possible to use the access points them- 
selves as monitoring points. 



addition, it is robust to changes in the environment. 

In summary, the contributions of this paper are four- 
fold: 

• We present the architecture and implementation of 
RASID: a system that provides robust device- free 
motion detection along with techniques for adapt- 
ing to environment changes and handling the wire- 
less signal noise. 

• We analyze different signal strength features that 
can be used for detection and identify the most 
promising one. 

• We evaluate the system in two different large-scale 
real testbeds and compare it to the state-of-the-art 
Dip detection techniques. 

• We present a comparison of parametric and non- 
parametric approaches for system operation. 

The rest of this paper is organized as follows: Section 
12] reviews related work. Section [3] presents the RASID 
system architecture and operation. Section 2] presents 
the experimental evaluation of RASID and a compari- 
son with other techniques. Section [5] compares the non- 
paramctric approach used in the system to a parametric 
analytical model for the system operation. In Section 
ini we discuss our experience with RASID and present 
some open research issues for future work. Finally, Sec- 
tion (7] concludes the paper and discusses future work. 

2. RELATED WORK 

Motion Detection in device-based systems has been 
an active field of research. Several works have been pro- 
posed to detect the motion of an entity carrying a device 
either with the use of special hardware like accelerome- 
ters or motion sensors [5}]8] , or by using the existing net- 
work infrastructures like wireless networks [5Hllj and 
GSM [Tldnj. 

From the device- free perspective, multiple technolo- 
gies can be used to provide the desired capabilities in- 
cluding: ultra- wide band radar [22], computer vision 
[TO] , physical contact based systems and radio to- 
mographic imaging [20] . Other technologies include the 
usage of wireless sensors for tracking transceiver- free ob- 
jects US] as well as the usage of RFID tags [23]. Those 
technologies share the requirement of installing special 
hardware to handle the device-free different functional- 
ities. In addition, cameras and IR sensors are limited 
to line-of-sight vision and thus they require a high cost 
deployment to cover all site regions. Moreover, regular 
cameras can fail to work in the dark or in the presence 
of smoke, and they can cause privacy concerns. Ultra- 
wide band radar based techniques also suffer from high 
complexity. Moreover, some techniques can require high 
density to provide full coverage like radio tomographic 
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imaging and physical contact based systems using pres- 
sure sensors. 

WLAN device-free passive systems try to avoid the 
above drawbacks by using the aheady available wire- 
less infrastructure. The concept of device-free passive 
detection and tracking using WLANs was first proposed 
in [13] with a large number of applications including in- 
trusion detection, border protection [25], smart homes, 
and traffic estimation [26]. Techniques for DfP detec- 
tion [mdSj and tracking [14l[T6l[T7] were introduced. 
The proposed techniques for the detection capability 
are either based on time-series analysis like the mov- 
ing average and moving variance techniques proposed 
in [14j or based on classification using the maximum 
likelihood estimation [15] . 

In comparison, RASID uses anomaly detection tech- 
niques to identify the deviations from the normal (si- 
lence) state. RASID system uses a semi-supervised 
statistical technique that models the learned normal be- 
havior using a kernel-function based non-parametric es- 
timation. The kernel-function based anomaly detection 
has been used in several applications where the distri- 
bution of the normal behavior is not known. For exam- 
ple, non-parametric estimation using Gaussian kernels 
was used in network intrusion detection j27j and novelty 
detection applied to oil flow data [28]. Also, density es- 
timation using Epanechnikov kernels was used in online 
outlier detection in sensor data [IH] and to achieve con- 
tinuous adaptive outlier detection on distributed data 
streams [30] . 

Compared to the previously proposed WLAN DfP 
detection techniques, the usage of the statistical anomaly 
detection technique, along with the other techniques de- 
vised for adapting to environment changes and refining 
the decision, enable RASID to achieve low deployment 
overhead, high accuracy and high robustness. 

3. THE RASID SYSTEM 

In this section, we give the details of the RASID sys- 
tem. We start by an overview of the system architecture 
followed by the details of the system modules. 

3.1 System Overview 

Figure [T] gives an overview of the system architec- 
ture. The modules of the proposed system are imple- 
mented in the application server that collects samples 
from the monitoring points and processes them. The 
system works in two phases: 1) A short ofRine phase, 
during which the system studies the signal strength val- 
ues when no human is present inside the area of interest 
to construct what we call a "normal or silence profile" 
for each stream. The profiles of all streams are con- 
structed concurrently in that short phase. 2) A moni- 
toring phase, in which the system collects readings from 
the monitoring points and decides whether there is hu- 



man activity (anomalous behavior) or not based on the 
information gathered in the offline phase. It also up- 
dates the stored normal proflle so that it can adapt 
to environment changes. Finally, a decision refinement 
procedure is applied to further enhance the accuracy. 

The Normal Profile Construction Module constructs 
the initial silence profiles based on a short, typically two 
minutes, training sample taken when there is no human 
motion present in the area of interest. (Section 13. 3p 

The Basic Detection Module examines each stream 
readings in the monitoring phase and decides whether 
there is an anomalous behavior or not. This operation 
is applied to each stream independently. It also assigns 
an anomaly score to each stream to express the intensity 
of the anomalous behavior. (Section 13. 5|) 

The Normal Profile Update Module updates the nor- 
mal profiles constructed in the offline phase in order to 
adapt to changes in the environment. (Section 13. 6p 

The Decision Refinement Module applies heuristic 
methods to refine the decision generated by the basic 
detection module to reduce the false alarm rates. (Sec- 
tion ET]) 

The Region Tracking Interface provides an interface 
that visualizes the output of the above modules. This 
interface enables the user to identify the detected events 
and provides the regions of the moving entities. (Sec- 
tion |3l]) 

We start by giving the mathematical notations fol- 
lowed by the details of the different modules. 

3.2 Mathematical Notations 

Let k be the number of streams, which is equal to 
the number of APs times the number of MPs. Let Sj^t 
denote the received signal strength (RSS) reading for a 
stream j that is received at a time instant t. The system 
studies the behavior of a sliding window Wj^t of size I 
that ends at time t, i.e. Wj^t = [sj,t-i+i, Sj^t-i+2, Sj,t]. 

In order to study the behavior of the sliding win- 
dows, each sliding window Wjj is mapped to a single 
feature or value Xj^t through a function g. For exam- 
ple, if the mean is the selected feature, then g{Wj^t) = 
jYl\=i ^3,t-i+i- Two types of features can be consid- 
ered: measures of central tendency, such as the mean, 
and measures of dispersion or variation, such as the 
variance. 

3.3 Normal Profile Construction 

The purpose of the Normal Profile Construction Mod- 
ule is to construct a normal profile, capturing the re- 
ceived signal strength characteristics when there is no 
human in the area of interest. This is used later by other 
modules to detect anomalies. This module runs in the 
offline phase. It extracts the feature values from the 
sliding windows over the collected data and estimates 
its distribution. The density function of the feature val- 



3 



ues observed is estimated using non-parametric kernel 
density estimatior(^. This is done for each stream inde- 
pendently. Figure [2] illustrates the operation. 

Formally, for a stream j, given a set of n sliding 
windows, each of length I samples, each window Wj^i 
is mapped to a value Xj^i, where Xj^i = g{Wj^i). As- 
sume fj is the density function representing the distri- 
bution of the observed Xj^s, then given a random sam- 
ple Xj^i,Xj^2, ■■■,Xj^n, the estimated density function fj 
is given by j31j : 



n 



(1) 



where hj is the bandwidth and V is the kernel function. 
The choice of the kernel function is not significant for 
the results of the approximation [32] ■ Hence, we choose 
the Epanechnikov kernel as it is bounded and efficient 
to integrate: 



V{q) 



1(1 



0, 



if kl < 1 
otherwise 



(2) 



Also, we used Scott's rule to estimate the optimal 
bandwidth 1321: 



h* = 2M5(Tjn- 



(3) 



where (fj is an estimate for the standard deviation for 

After estimating the density function for the feature 
values extracted from the sliding windows, critical bounds 
are selected so that if the feature values observed in 
the monitoring state exceed those bounds, the observed 
values are considered anomalous. Given a significance 
parameter a and assuming Fj is the CDF of distribu- 
tion shown in Equation [TJ if the feature is a measure of 
central tendency, which can deviate to the left or the 
right, then lower and upper bounds will be calculated 

such that the lower bound is Fj (a/2) and the up- 
per bound is Fj (1 — a/2). However, if the feature 
is a measure of dispersion, which can only deviate in 
the positive (or right) direction, then an upper bound 

is only needed and is equal to Fj (1 — a). In the next 
subsection, we study different features that can be se- 
lected. 

3.4 Feature Selection 

As the system requires an offline phase before opera- 
tion, to learn the behavior of the signal readings in the 
normal state, the selected feature for system operation 
should be resistant to possible environmental changes 



^In Section \5\ we present the motivation for using a non- 
parametric approach by providing a performance compari- 
son with a parametric modeling of the system operation. 



that may affect the stored data, e.g. temporal varia- 
tionf[f|. In addition, the selected feature should also be 
sensitive to the human motion to enhance the detection 
accuracy. 

In this section, we compare two categories of fea- 
tures: central tendency measures and dispersion mea- 
sures. The goal of this study is to identify the category 
that will be more promising for the system operation. 
For this study, we consider the mean as a central ten- 
dency measure, and the standard deviation as a measure 
of dispersion. We use the standard deviation, rather 
than the variance, as the variance is a squared measure, 
while the mean is not. 

3.4.1 Sensitivity to human activity 

The selected feature should be sensitive to human 
activity. To compare the two features, we use the Eu- 
clidean distance between the normalized histograms rep- 
resenting the silence and motion states. The Euclidean 
distance is defined as the square root of the sum of the 
squared distance between each corresponding histogram 
bin. The histograms are constructed over a two-minute 
period for each state using Tcstbed 1, which is discussed 
later in Section |4l Figure [3] shows the comparison ver- 
sus different window sizes. The figure shows that the 
distance between the histograms of the standard devia- 
tion is larger than the distance between the histograms 
of the mean. This indicates that the standard devia- 
tion feature is more discriminant of the human motion 
than the mean feature. This conclusion can be justi- 
fied by observing the motion effect on typical wireless 
signals. Figure |4] provides a visualization of the raw 
signal strength for two different streams during silence 
and human motion periods. The figure shows that in 
the case of human motion, the fiuctuations can be up 
or down around the normal/silence signal level, which 
leads to a limited effect on the mean as compared to 
the standard deviation. 

3.4.2 Resistivity to temporal variations 

As the proposed system requires a learning phase be- 
fore operation, it is necessary to reduce the temporal 
variation effect on the stored profiles. To compare the 
two features, we use two different silence data sets col- 
lected two weeks apart. Figure [5] shows the results. The 
more similar the histograms, the more resistive the fea- 
ture is to the introduced variations. The figure shows 
that the standard deviation feature is less affected by 
temporal variations. This is due to the fact that the 
standard deviation is a relative measure as it is calcu- 
lated with respect to the mean, whereas the mean itself 



''Our experiments sliow that the changes in tire traffic load 
on the network do not afi^ect the signal strength. Therefore, 
temporal variations here refer to changes in the physical 
environment that affect the signal strength. 
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Figure 2: Illustration of the normal profile construction. 
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Figure 3: Distance between the features' nor- 
malized histograms for silence and motion 
states. 
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Figure 5: Distance between the features' nor- 
malized histograms for the two week-separated 
silence data. 
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Figure 4: Illustrating the motion effect on wire- 
less signals of two different streams. 

provides an absolute value that is more susceptible to 
be affected by changes in the conditions. 

From this study, we conclude that the measures of 



dispersion, e.g. the standard deviation or variance, are 
more suitable for our proposed system. For the rest of 
the paper, we use the sample variance as the selected 
feature. 

3.5 Basic Detection Procedures 

The Basic Detection Module runs during the moni- 
toring phase. The purpose of this module is to detect 
signal strength anomalies, i.e. human presence, based 
on the normal profiles constructed during the offline 
phase. In particular, for a window of samples Wj^t for 
stream j at a given time instant t, the module calcu- 
lates the corresponding feature value Xj.t, i.e. the sam- 
ple variance. A stream j is considered anomalous if Xj^t 
is above a critical bound Uj. Given a significance pa- 
rameter a and assuming Fj is the CDF of distribution 
shown in Equation [U the upper bound Uj will be equal 
to the 100(1 — a)*'' percentile of the CDF function, such 
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that Uj = Fj (1 — a). 

The Basic Detection Module declares a global alarm 
when any stream is anomalous. This approach can lead 
to many false positives due to signal strength outliers. 
This is enhanced later by the Decision Refinement Mod- 
ule. The Basic Detection Module also calculates an 
anomaly score aj t for each stream j to keep track of 
the significance of any anomalous activity. For a given 
window, Wj^t, the anomaly score, Oj.t, can be calculated 
as: aj,t = where Xj^t is the sample variance of the 
window and Uj is the critical value. This means that a 
detected anomaly will have a score greater than one and 
a silence window will have a score of less than one. The 
anomaly score is used by the Normal Profile Update 
and Decision Refinement modules to further enhance 
the accuracy. 

In summary, the basic detection procedure requires 
two parameters: the window size I and the significance 
a. Analysis of both parameters is presented in Section 



3.6 Capturing Changes in the Environment: 
The Normal Profile Update Module 

Due to the dynamic changes in the environment, the 
stored profiles may not capture the real normal state. 
Therefore, the systems needs to update the stored pro- 
files during the online phase. The technique we employ 
for handling the update process is based on continu- 
ously updating the estimated density in Equation [1] 
by adding Xj.t's, that do not have high anomaly scores 
in average to it. In particular, during the monitoring 
phase, the system groups the consecutive x^.t's in dis- 
joint groups of size ^update- The group that has an av- 
erage anomaly score of less than one is added to the 
normal profile. The parameter /update can be tuned to 
provide the desired performance. We quantify the effect 
of the /update parameter in detail in Section [4.3.21 

Adding new data to the normal profiles implies the 
need to give more weight to the recent data. Therefore, 
Equation [1] is modified to: 



1 " 



J i=l ^ J 



X ~ X 



3-1 



(4) 



where 



- 1. We choose linear weights such that 

Wi = n(„^!i-)/2 constant). We found that exponen- 
tial weights do not provide good performance due to 
the high discrimination introduced between older and 
newer data. 

3.7 The Decision Refinement Module 

Typical wireless environments are noisy. This fact 
can cause many false alarms if the system generates 
alarms just based on a single stream. The goal of the 
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Figure 6: The behavior of the sum of anomaly 
scores for Testbed 1. 



Decision Refinement Module is to reduce the false alarm 
rate by fusing different streams. 

Since the Basic Detection Module assigns an anomaly 
score to each detected event that expresses its signifi- 
cance, this can be leveraged to enhance the detection 
performance. The Decision Refinement Module studies 
the behavior of a global anomaly score at that is cal- 
culated by summing the individual anomaly scores for 
each stream. If a noticeable change in at occurs, based 
on a threshold, while at least one stream is anomalous, 
this implies the start of an anomalous behavior. The 
module makes use of the history of the activity state 
inside the environment through the usage of exponen- 
tial smootliing to monitor the at in order to avoid the 
noisy samples, hence reducing the false alarm rate. It 
also implicitly makes use of the locality of human mo- 
tion, meaning that the human will continue to affect the 
same stream and/or other streams near it, causing the 
sum of anomaly scores smoothed curve to have higher 
values during the motion period (Figure |6|) . 

3.8 Region Tracking User Interface Module 

The system provides an interface that provides in- 
formation about the probable regions of the detected 
event. This is based on visualizing the anomaly degree 
of each stream enabling the user to identify the regions 
that probably have moving entities inside. This is done 
by coloring each pixel on the map according to its dis- 
tance from each stream cndpoints and according to the 
anomaly score of each stream. Figure [7] displays the 
output of this interface when two persons are moving 
inside a typical site, showing the true locations of the 
two persons. 

4. EXPERIMENTAL EVALUATION 

In this section, we study the effect of the different 
parameters on the performance of the RASID system 
and compare it to the previous WLAN DfP detection 
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(a) Silence State 




(b) Two Persons Moving 



Figure 7: The output of the Region Tracking 
Interface. 

techniques [MlllSj . 

4.1 Experimental Testbeds and Data Collec- 
tion 

We collected two sets of data to evaluate the sys- 
tem performance, each in a different testbed. The first 
testbed is an office of approximately 2000 ft^. The 
second experiment was conducted in a two-floor home 
building where each floor was approximately 1500 ft^. 
Both tesbeds were covered with typical furniture. For 
both testbeds, we used four Cisco Aironet 1130AG se- 
ries access points and used three DELL laptops equipped 
with D-Link AirPlus G+ DWL-650-h Wireless NICs as 
MPs. The access points were operating on different 
channels. The experiments were conducted in typical 
IEEE 802.11b environments. Figures [5] and IH] show the 
layouts of both experiments. 

For the data collection, sets of normal (silence) state 
readings and continuous motion readings were collected 
for each testbed. A total of about one hour and 15 
minutes of data was collected for each testbed with a 




^5.6m- 



Figure 8: Testbed 1 layout and motion pattern. 

sampling rate of one sample per second using the active 
scanning technique [4]. For Testbed 1, this includes 
three motion sets, while for Testbed 2, this includes 
two motion sets. A motion set covers the entire area of 
the testbed, as shown in figures [5] and [51 and represents 
the motion of a single person walking normally around 
the site without any stops. 

For system evaluation, extreme conditions were em- 
ployed: The training period is chosen to be only the 
first two minutes of the entire data collected with the 
absence of human motion. In addition, only one person 
moved in the area of interest. More people in the area of 
interest will lead to higher variance |33| and hence bet- 
ter detection. Therefore, the reported results present a 
lower bound on the performance of the RASID system. 

4.2 Evaluation Metrics 

We used three metrics to analyze the detection per- 
formance: the false positive (FP) rate, the false negative 
(FN) rate and the F-measure. The false positive rate 
refers to the probability that the system generates an 
alarm while there is no human motion in the area of 
interest. The false negative rate refers to the probabil- 
ity that the system fails to detect the human motion in 
any place in the area. We also use the F-measure, which 
provides a single value to measure the effectiveness of 
the detection system [34]. 

Since each anomalous sample may not be detected 
simultaneously, we also studied the detection latency, 
i.e. how much time the system needs to associate an 
anomalous sample with a detected event. The overall 
90*'* detection latency percentile in both testbeds was 
found to be less than one second. 

4.3 System Performance 
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Basic Detection 
Module 


Normal Profile 
Update Module 


Decision Refinement 
Module (rLAhlJJ Jreri.) 




FN Rate 


0.0672 


0.0875 


0.0468 


Testbed 1 


FP Rate 


0.2158 


0.1176 


0.0378 


F- measure 
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Enhancement 




3.52% 


10.26% 




FN Rate 


0.2368 


0.2069 


0.0966 


Testbed 2 


FP Rate 


0.1059 


0.0903 


0.0372 


F- measure 


0.8167 


0.8422 


0.9311 




Enhancement 




3.1% 


14% 



Table 1: System performance under the same parameters (/ = 5,q: = 0.01,Zupdate = 15) for the two 
testbeds. Enhancement is with respect to the F-measure of the Basic Detection Module. 
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Figure 9: Testbed 2 layout and motion patterns. 

Table [T] summarizes the system performance for both 
testbeds using the same parameters for all modules. 
The table also shows the enhancement introduced by 
each module to show the robustness of the techniques. 

4. 3. 1 Basic Detection Module 



As mentioned earlier, this module requires the selec- 
tion of the sliding window size I and the significance 
a. Figure [TU] illustrates the effect of these parameters 
applied to Testbed 1. Similar performance has been ob- 
served for Testbed 2. The figure shows that choosing a 
too short window size will make the system less sensitive 
to human motion. On the other hand, choosing a very 
large window size will introduce a very high FP rate. 
For the significance parameter, as a decreases, the FP 
rate decreases and the FN rate slightly increases. This 
means that increasing the significance will result in less 
system sensitivity. Therefore, to balance the different 
performance metrics, we choose I = 5 and a = 0.01. 

Table [1] shows that Testbed 2 has a higher FN rate 
than Testbed 1 in the Basic Detection Module. This is 
due to the larger testbed area (i.e. less coverage) and 
the time needed to move between the floors in Testbed 
2. This is significantly enhanced by the processing per- 
formed by the Normal Profile Update and Decision Re- 
finement modules. It can be noted also that the FP 
rate in Testbed 1 is relatively high. This is because 
the two-minute training period is not enough to sustain 
accurate detection for one hour of accurate operation 
inside the office environment. This highlights the need 
for the Normal Profile Update Module. 

4.3.2 Normal Profile Update Module 

The Normal Profile Update Module requires the se- 
lection of the update window size ^update- Choosing a 
too small ^update will make the system very sensitive to 
noisy readings causing a high FP rate. On the other 
hand, a very large ^update will make the system less sen- 
sitive to human motion causing a higher FN rate. Fig- 
urcfTT] illustrates these effects of the update window size 
on the system performance for Testbed 1 when I ~ 5 
and a = 0.01. The figure shows that an update window 
size between 10 and 20 is sufficient to reduce the high 
FP rate without causing much increase to the FN Rate. 
Thus, we choose lupdate = 15. The results are shown 
in Table [TJ The table shows that there is about 50% 
reduction in the FP rate in the first testbed, but this 
lead to a slight growtli in the FN rate. For Testbed 2, 
the results of both the FN and the FP rates were en- 
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Figure 10: Analysis of the Basic Detection Mod- 
ule parameters for Testbed 1. 



hanced due to adapting to the environment. Overall, 
the F-measure was enhanced by 3 to 4% with respect 
to the Basic Detection Module performance. 

This enhancement can be explained by the observa- 
tion that the Normal Profile Update Module reduces 
the effect of the temporal variations between the en- 
vironment true normal profiles and the stored normal 
profiles by updating them. We verified that by applying 
the two-sample Kolmogorov-Smirnov test to the distri- 
butions of the updated profiles and the distributions of 
the true normal state. The test accepted the hypotheses 
that those distributions came from the same underlying 
distribution at a significance of 0.05. Figure [T^] provides 
an example comparing the starting, updated and true 
sample variance profiles at the end of Experiment 1. 
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Figure 12: Comparison between the starting 
profile, updated profile and the true profile for 
the sample variance of the AP4-MP3 stream at 
the end of Experiment 1. As shown, the updated 
and true profiles are almost congruent. 

4. 3. 3 Decision Refinement Module 

This module fuses the data from all streams. Fig- 
ure [6] displays the sum of anomaly scores curve for the 
data collected for Testbed 1. To reduce the FP rate, 
the curve is exponentially smoothed with a smoothing 
coefficient of 0.04. A large increment in the smoothed 
curve, by more than 20% to 25% from the normal level, 
implies a period of human motion. Our experiments 
show that deviations from these parameters values will 
not lead to significant degradation in the results. The 
figure shows that the motion periods are clearly distin- 
guishable from the silence state. Table [T] shows that 
this module can lead to up to 10 to 14% enhancement 
in the F-measure for both testbeds with respect to the 
Basic Detection Module. It is important to note that 
this module also reduced the FN rate, as some of the 
previously undetected events are now detected because 
this technique makes use of the history of the state of 
the activity as described earlier. 

4.4 Comparison with Previous Techniques 
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In this section, we compare the performance of RASID 
to the previous techniques devised for WLAN DfP de- 
tection. We start by a brief description of the tech- 
niques, followed by the different aspects we evaluate 
the techniques on. Finally, we present the results of the 
comparison. 

4.4.1 Comparison Techniques 

Three techniques are considered for the comparison; 

1. The moving average technique [Ij: The moving 
average technique uses a central tendency feature, 
i.e. the average. It uses two sliding window av- 
erages: a short window average representing the 
current system condition and a long window aver- 
age representing history. The idea is to compare 
the two averages and if the difference is above a 
threshold, a detection is announced. It is impor- 
tant to note that the moving average technique 
does not require a training phase. 

2. The moving variance technique |14j : The mov- 
ing variance technique uses a dispersion feature, 
i.e. the variance. Similar to the moving average 
technique, it compares the variance of the current 
system state, based on a sliding window, to the 
variance of the silence period, obtained through a 
training phase. If the difference is above a thresh- 
old, a detection is announced. 

3. The maximum likelihood classification (MLE) tech- 
nique |15] : This technique constructs profiles for 
the silence period as well as for the motions period 
for different locations in the area of interest. The 
profiles represent the signal strength distribution 
for each stream at each location. Therefore, it in- 
volves significant training data. During the detec- 
tion phase, the system finds the profile that has 
the maximum likelihood given a signal strength 
vector, one entry for each stream. If the estimated 
profile corresponds to a motion profile, an alarm 
is generated. 

4.4.2 Comparison Aspects 

• Static accuracy: accuracy when the system is eval- 
uated with the same profiles it was trained on (if 
any). This is to test the best attainable accuracy. 

• Profiles' robustness: that is how consistent the 
performance of the system is when the tested pro- 
files are different from the trained ones, for exam- 
ple due to temporal changes in the environment. 
For this case, the testing data set is collected two 
weeks after the data sets used for training. 

• Overhead: the effort needed to deploy the system. 



4.4.3 Comparison Results 

Table [2] shows the comparison results in two cases. 

In terms of the static accuracy, the results show that 
the F-measure of the RASID system is better than other 
systems in Testbed 1 and is slightly lower than the MLE 
technique in Testbed 2. Compared to the Moving Aver- 
age and Moving Variance techniques, the RASID sys- 
tem provides high accuracy due to the techniques it 
uses to enhance the performance. On the other hand, 
the MLE technique achieves slightly higher accuracy in 
Testbed 2 as it stores a motion profile, which requires 
much higher overhead than the RASID system. 

In terms of profiles' robustness, the Moving Aver- 
age technique does not store any profiles. Therefore, 
its overall performance is low but almost the same as 
the profiles change. On the other hand, the robustness 
of the MLE technique is the least as it uses the mean 
signal strength values as the features used for classi- 
fication. Therefore, after two weeks, the distribution 
of the signal strength docs not follow the learned one. 
This is why the FP rate for the MLE technique is too 
high due to the shift that occurred in the signal dis- 
tributions. It can also be noted that RASID perfor- 
mance in the two cases was the best because RASID 
uses the variance for its operation (dispersion feature) 
and employs techniques for adapting to changes in the 
environment and for enhancing the performance. This 
is why RASID performance is better than the Moving 
Variance in general, although the Moving Variance uses 
the same feature as RASID. 

In terms of overhead, the Moving Average technique 
has the minimum overhead as it docs not need any 
learning phase. The Moving Variance and RASID de- 
ployment need to construct normal profiles by collecting 
samples for two minutes when the human is not present. 
On the other hand, the MLE technique has the worst 
overhead as it constructs motion profile at each location 
in the of interest in addition to the normal profile. 

In summary, although the static detection accuracy 
of RASID is as accurate as the MLE technique, the 
MLE technique has significantly higher overhead than 
RASID because of its motion profile requirements. In 
addition, RASID is the most robust technique to tem- 
poral changes in the training profiles and significantly 
outperforms the remaining techniques. 

5. COMPARISON WITH A PARAMETRIC 
APPROACH 

In this section, we compare the performance of the 
system's non-parametric approach to an analytical model 
that models the sample variance parametrically. The 
results of this model can help validate the results of our 
parameter analysis in the previous section and can also 
motivate the usage of the non-parametric density esti- 
mation. The next evaluation will be based on the results 
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Table 2: Performance comparison with previous DfP detection techniques. 



of the Basic Detection Module only, so as to evaluate 
the two approaches without the enhancements. First, 
we describe the analytical model, then we present the 
results of the comparison. 

5.1 The parametric model 

The sample variance can be modeled parametrically 
given some conditions. According to Cochran's The- 
orem |35] . the sample variance of I independent nor- 
mally distributed random samples follows a chi-square 
distribution with I — 1 degrees of freedom such that 

^'"^V ~ X?-iJ where is the population variance. 
According to [35] , the signal strength readings (in dBm) 
distributions for a stream j can be assumed to follow 
a normal distribution. Given that assumption, a para- 
metric model can be devised for the system when the 
sample variance is used. Given a significance a and a 
window size I, the upper bound for the sample vari- 
ance observed during the monitoring phase is x?_i 
However, [35] also stated that the normality assump- 
tion may not hold in some cases. In addition, the signal 
strength readings may not be independent [37] ■ Thus, 
we believe that the non-parametric model described be- 
fore will provide better performance than the paramet- 
ric model. This will be verified in the following subsec- 
tion. 

5.2 Analysis Results 

First, to check how close the parametric model is 
to the actual system, we compare the critical upper 
bounds obtained by both methods. For example, in 
Figure [T3] we compare the critical sample variance val- 
ues in both cases for the stream AP4-MP3 from Exper- 
iment 1, when the population variance is assumed to be 
2.02 dBm^ which is an experimental estimate for the 
population variance of that stream. The figure shows 
that the parametric model and the actual system crit- 
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Figure 13: Comparison of the critical variance 
values of the parametric model and the RASID 
system model (non-parametric approach). 



ical values follow the same trends. However the differ- 
ence between the curves suggests that the real case does 
not exactly follow the assumed parametric model. In 
addition, the effects of Basic Detection Module param- 
eters can be inferred from the parametric model curves. 
As the window size parameter / increases, the critical 
variance value decreases which results in increased sys- 
tem sensitivity (i.e. higher FP rate and lower FN rate). 
Also, as the significance parameter a increases, the crit- 
ical variance value decreases which also results in in- 
creased sensitivity. This is consistent with the analysis 
presented in Figure 1101 

The next point is to study how the usage of the para- 
metric model instead of non-parametric estimation can 
affect the system performance. As the distribution of 
the sample variance depends on the population vari- 
ance, we analyze its effect. Figure [Til shows the effect 
of the population variance on the performance of the 
Basic Detection Module when the parametric model is 
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Figure 14: The performance of the Basic De- 
tection Module when the parametric model is 
used versus the population variance, given I = 5 
and a = 0.01. The best population variance con- 
figuration provides an F-measure of 0.843 com- 
pared to 0.8683 that was obtained using the non- 
parametric estimation. 

used for Experiment 1. From, the figure, we can con- 
clude that the best performance achieved in terms of 
the F-measure (0.843) is less than the F-measure ob- 
tained using non-parametric estimation (0.8683). 

To conclude, the parametric model leads to lower per- 
formance compared to the non-parametric estimation 
because the assumptions that the signal strength val- 
ues are independent and follow a normal distribution 
may not hold. Also, the parametric model requires the 
selection of an accurate population variance. This can- 
not be done accurately without training for long time 
periods. Therefore, we conclude that RASID approach 
of constructing non-parametric profiles in a short of- 
fline phase and updating them in the online phase does 
provide a better option. 

6. DISCUSSION 

In this section, we discuss some points related to the 
configuration and the performance of the RASID sys- 
tem. We also highlight some research issues and some 
challenges that can be addressed in future work. 

6.1 Univariate VS Multivariate Density Esti- 
mation 

As mentioned before, the basic detection module stud- 
ies each stream independently by estimating the uni- 
variate density for the selected feature of the sliding 
windows extracted from the training data. Another 
possibility was to construct a multivariate density es- 
timate for the data of all streams. This implies a mod- 
ification to the anomaly detection criteria. Different 
algorithms can be applied in this case, e.g. [27]. Our 
experience with this algorithm shows that this leads to 
a degradation of the system accuracy. The main rea- 



son for this degradation is that the system sensitivity 
is significantly reduced, especially when the number of 
streams is large. In that case, the system may not be 
able to detect an anomaly in one stream only, as its 
effect may not be much sensed. 

6.2 Effect of Network Activity on System Pro- 
files 

Typically in real wireless environments, it is expected 
that many monitoring points may be using the wireless 
network for handling typical tasks (e.g. downloading 
updates or patches) . The question is whether such net- 
work activities will require any change in the system 
normal profiles if they were originally collected while 
there is no network activity. In this subsection, we 
present an experimental study to investigate that ef- 
fect. 

In order to examine that effect, a simple experiment 
was conducted on a single stream between an access 
point and a laptop acting as a monitoring point in si- 
lence state. Two signal strength data sets were collected 
while there was no network activity at the monitoring 
point, while another two sets were collected while the 
monitoring point were downloading data through the 
wireless stream with the maximum download speed al- 
lowed (50 KBytes per second). The collected data are 
used to construct normal profiles in the same way pre- 
sented earlier in Section 13.31 Figure [15] compares the 
constructed profiles for the four sets. From the figure, it 
is clear that the difference between the distributions in 
both cases is negligible. Furthermore, we apply the two- 
sample Kolmogorov-Smirnov test to each of the four 
different pairs of those constructed profiles. The test 
accepted the hypotheses that those estimated distribu- 
tions came from the same underlying distribution with 
a significance of 0.05. Therefore, we can conclude that 
the constructed sample variance profiles are invariant 
with respect to the state of network activity. 

6.3 Detection and Identification of Indepen- 
dent Events 

The above experiments showed that the system is ca- 
pable of detecting a single person moving inside the area 
of interest. Obviously, the detection performance will 
be enhanced if there were more than one entity in the 
area of interest. We verified that the system will be able 
to declare that there is anomalous behavior inside the 
area more clearly in this case. 

It would be useful to identify the number of moving 
entities in some applications. Figure [7] shows that we 
can detect that there are multiple entities in the area of 
interest. However, as our system uses limited data to 
satisfy the feasibility design goal (normal profiles only), 
the system cannot provide full information about the 
number of entities in all cases. For example, if two 
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Figure 15: The effect of network activity on the 
constructed sample variance normal profiles. As 
shown, the difference between the profiles is not 
significant. 

entities are affecting a single stream only, the system 
will detect them as one entity. This is because there 
is no enough information that enables the system to 
differentiate between the two cases. On the other hand, 
in some cases, the system can tell with high probability 
that some events are due to independent entities. Here, 
we briefly describe the constraints through which the 
system can provide information about the number of 
independent entities. 

First, let Tmim a k x k square matrix denote what we 
call a minimum time reachability matrix. Each entry 
in this matrix stores the minimum time needed for an 
entity to affect two streams i and j , such that 



^max 

, where Dmimj represents the minimum distance be- 
tween the nearest two points on the i and j streams 
lines of sight and Vmax represents the maximum move- 
ment velocity inside the area. The distance Dmim can 
be calculated from the site map, and Vmax can be esti- 
mated based on empirical observations. 

Two events Ei and E2 are considered independent 
(i.e. not generated by the same entity), if they satisfy 
the following conditions. First, they should be affecting 
two different streams i and j and second, the time dif- 
ference between Ei and E2 is less than the value Tmimj ■ 
The time difference between the two events are calcu- 
lated based on the time difference between the times 
when the anomaly scores for the two events reach the 
peaks as they express the moments when the entities 
are affecting the streams the most. To tell that n events 
are independent, each pair of those events should satisfy 
the conditions described above. The above conditions 
imply that the system cannot detect more than k mov- 
ing entities, where k is the number of streams as stated 



earlier. 

To conclude, despite the limited information the sys- 
tem uses, the system can provide information about the 
number of independent events inside the monitored area 
given some conditions. The significance of this point 
can be clear when applied inside large scale environ- 
ments. 

Another possibility is to use the level of the change 
in variance as an indication of the number of entities. 
The hypothesis is that the more human affecting a sin- 
gle stream, the higher the variance should be. This 
hypothesis still needs to be verified though. 

6.4 Integration with DfP Tracking Systems 

Our system can provide useful information to DJP 
tracking systems like the ones proposed in (TB1IT7] . First, 
a DJP tracking system can use our system to decide 
whether to start the tracking process or not. Also, the 
system can enhance the tracking accuracy by limiting 
the probable locations to a certain area (e.g. as in Fig- 
ure [71) . In addition, given the conditions described ear- 
lier, our system can help the tracking system identify 
the number of intruders and the area of each one, so 
that it can apply the tracking algorithms to each area 
independently. This will need further investigation and 
experimentation. 

6.5 Combining Features 

Although we showed in this paper that using the vari- 
ance as a feature is better than using the mean, both 
features can be used concurrently to achieve better per- 
formance. Our initial results show that combining both 
features and using a simple voting scheme can enhance 
the results in some cases. This is a subject for future 
investigations. 

6.6 Signal Strength Readings Synchronization 

The synchronization of the signal strength readings 
received at the monitoring point can be necessary in 
some cases. For example, the technique described be- 
fore for checking the independence of the detected events 
requires synchronization of the readings across the streams. 
In addition, the decision refinement module requires the 
different streams to be synchronized. In this paper, we 
took a centralized approach for synchronization, where 
the application server requests the MPs to initiate a 
reading. Other approaches, such as time synchroniza- 
tion of the MPs can be employed. The advantages and 
disadvantages of each technique in terms of accuracy 
and overhead can also be investigated. 

6.7 Effect of Different Hardware 

The hardware used to capture the signal strength val- 
ues can affect system performance. Through our exper- 
iments, we studied how the WLAN NIC type affects the 
quality of the collected readings. We found that NICs 
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differ in two main aspects: sensitivity to human activ- 
ity and noise readings. For example, some cards cannot 
sense the liuman shadowing effect unless it is sustained 
for a sufficient period of time. The readings of some 
other cards are noisy and requires extensive filtering. 
These experiments considered the NICs only. However 
this can hold from the APs perspective too. Therefore, 
we believe a study is needed to identify which hardware 
will be more suitable for the system operation and how 
to account for these variation between cards and allow 
the system to operate with different cards. 

7. CONCLUSIONS AND FUTURE WORK 

In this paper, we presented the RASID system, a sys- 
tem that enables device-free passive motion detection 
using the already installed wireless networks. RASID 
uses non-parametric statistical anomaly detection tech- 
niques to provide the detection capability. The RASID 
system also employs profile update techniques to cap- 
ture changes in the environment and to enhance the 
detection accuracy. The system was evaluated in two 
different real environments. Using the same parameters 
for the two tcstbeds, the system provided an accurate 
detection capability reaching an F-mcasure of at least 
0.93 in both testbeds. The performance of the RASID 
system was compared to the previously introduced tech- 
niques for WLAN DfP detection. The results showed 
that the RASID system outperformed the state-of-the- 
art techniques in terms of robustness and accuracy. In 
addition, we showed that the non-parametric approach 
employed by RASID has significant advantages over a 
parametric approach for the system operation. 

Currently, we arc expanding RASID in several direc- 
tions; One direction is to integrate RASWs detection 
capability with DfP tracking systems while considering 
larger testbeds. Another direction is to study possible 
sources of noise in typical wireless environments, e.g. 
other devices inside or outside the area of interest, and 
how to reduce their effect. We are also studying how 
the detected entity's characteristics, e.g. size, shape 
and motion pattern, can affect the system performance. 
Moreover, the site configuration, i.e. the positions of the 
APs and MPs, can also be studied in order to optimize 
the system performance. 
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